Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm a Linux newbie. I have a PHP script which, based on the correctness of a few parameters, decides whether to serve a file to the user or not. I'm serving files through the XSendFile feature in nginx. I'd like to block direct access to files so that the user is forced to download them through the PHP script.

My problem is that if I set the files permissions to 640, when I try to download directly I get a 403 Forbidden, but I'm unable to download it with the script as well. Whereas if I set it to 644, I'm able to do both things (I thought one needed to add the Execute permission to enable direct download of a file. Was I wrong?) How should I setup permissions to achieve what I need?

Edit: Note that I can't move the files above the web root directory, because some files must have direct access while others must not. So I have to keep them all in the same directory and be able to enable/disable direct downloading selectively.

share|improve this question
add comment

1 Answer

up vote 1 down vote accepted

Nginx has a directive for that. You may mark a location as "internal" which means Nginx processes it only as a result of rewrite, X-Accel-Redirect and alike. If you'd try to request this location directly, you'll get 404 "Not Found" response.

location /downloads {
  internal;
}

location /scripts {
  # should issue X-Accel-Redirect: /downloads/file.ext
}
share|improve this answer
    
Yeah, I eventually figured that out. The problem is, as some files should be directly downloadable and some should not, I can't really do that. So, I think I'll adjust my needs and make two different folders. Thanks anyway. I'll accept the answer because it will help others who don't know about the internal directive. –  pt2ph8 May 19 '11 at 13:11
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.